This vulnerability in Themeisle MPG plugin versions up to 3.4.7 allows SQL Injection due to improper neutralization of special elements in SQL commands. The CVSS 3.1 score is 8.5, indicating high severity with network attack vector, low attack complexity, requiring low privileges and no user interaction. The impact includes high confidentiality compromise and low availability impact. No patch or vendor advisory is currently provided, and the product is not a cloud service.

Successful exploitation could allow an attacker to perform SQL Injection attacks leading to unauthorized disclosure of sensitive data (high confidentiality impact) and partial denial of service (low availability impact). Integrity impact is not indicated. The vulnerability can be exploited remotely with low complexity and low privileges, increasing the risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict access to the affected plugin and monitor for unusual database activity. Avoid exposing the vulnerable plugin to untrusted users if possible.